@sikkuumiii/defuse 0.0.0-stage → 0.5.0

package/docs/examples/defuse.json

@@ -0,0 +1,20 @@
+{
+  "//": "Copy to .defuse.json in your repository root. Every key here also",
+  "//exclude": "exists as a command-line flag, and the flag always wins.",
+
+  "exclude": ["node_modules", "dist", "vendor", "**/*.min.js"],
+
+  "//failOn": "Exit 1 at or above this level. 'none' always exits 0.",
+  "failOn": "critical",
+
+  "//minSeverity": "Hide below this level in the TERMINAL report only. Findings",
+  "//minSeverity2": "stay in --json and --sarif regardless - the machine output",
+  "//minSeverity3": "is never allowed to be rosier than the human one.",
+  "minSeverity": "info",
+
+  "//only": "Restrict to these rule ids. Omit to run every rule.",
+  "//note": "There is deliberately NO way to disable a rule here. A config that",
+  "//note2": "can switch off the rules a repo fails makes findings vanish with",
+  "//note3": "no record. Use defuse:ignore <rule> - <reason> on the line",
+  "//note4": "instead; those are counted and listed in every report."
+}

package/docs/examples/dvwa-urls.json

@@ -0,0 +1,14 @@
+{
+  "base": "http://dvwa/",
+  "root": "corpus2/DVWA",
+  "trigger": "Submit=Submit",
+  "rules": [
+    ["^vulnerabilities/brute/source/(low|medium)\\.php$", "vulnerabilities/brute/", "security=$1", "Login=Login"],
+    ["^vulnerabilities/brute/source/(high|impossible)\\.php$", "vulnerabilities/brute/", "security=$1", {"untestable": "the page wants a fresh anti-CSRF token on every request, which this scan does not fetch"}],
+    ["^vulnerabilities/captcha/source/(low|medium|high|impossible)\\.php$", "vulnerabilities/captcha/", "security=$1", {"untestable": "the code only runs after a passed reCAPTCHA, which this scan cannot solve"}],
+    ["^vulnerabilities/([^/]+)/source/(low|medium|high|impossible)\\.php$", "vulnerabilities/$1/", "security=$2"],
+    ["^vulnerabilities/view_help\\.php$", "$&", "", "security=low&locale=en"],
+    ["^vulnerabilities/view_source\\.php$", "$&", "", "security=low"],
+    ["^vulnerabilities/.+\\.php$", "$&"]
+  ]
+}

package/docs/examples/github-code-scanning.yml

@@ -0,0 +1,54 @@
+# Run Defuse on every pull request and publish the results into
+# GitHub's Security tab.
+#
+# WHAT YOU WILL SEE, and why it looks different from other scanners:
+#
+# A finding whose data flow was TRACED arrives with a SARIF codeFlow attached,
+# so GitHub renders the full source-to-sink path as clickable steps. A finding
+# that was only pattern-matched has no codeFlow, and its message opens with
+# "[signature-based, UNVERIFIED]". That asymmetry is deliberate - it is the
+# whole point of the tool, and it survives the trip into CI rather than being
+# flattened into "12 alerts".
+#
+# --fail-on controls the build, and is SEPARATE from what gets uploaded.
+# Everything is reported to the Security tab; only findings at or above
+# --fail-on stop the pipeline. Start at `critical` on an existing codebase and
+# tighten once the backlog is down, rather than switching rules off.
+
+name: Security scan
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  security-events: write   # required to upload SARIF
+
+jobs:
+  defuse:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Build the scanner
+        run: npm ci && npm run build
+
+      # `|| true` so a failing gate still uploads its results - a blocked merge
+      # with no visible reason is a worse experience than a noisy one.
+      - name: Scan
+        run: node dist/src/cli.js scan . --sarif --fail-on=critical > defuse.sarif || true
+
+      - uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: defuse.sarif
+          category: defuse
+
+      # Re-run for the exit code, now that the results are safely uploaded.
+      - name: Enforce the gate
+        run: node dist/src/cli.js scan . --quiet --fail-on=critical

package/docs/examples/tiny.js

@@ -0,0 +1,4 @@
+function getUser(req) {
+  const userId = req.query.id;
+  return db.query("SELECT * FROM users WHERE id = " + userId);
+}

package/package.json

@@ -1,6 +1,75 @@
 {
   "name": "@sikkuumiii/defuse",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.5.0",
+  "description": "A SAST scanner that labels every finding signature-based or flow-verified, and prints what it did not check.",
+  "license": "AGPL-3.0-only",
+  "author": "Farhaad",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sikkuumi/Defuse.git"
+  },
+  "homepage": "https://github.com/sikkuumi/Defuse#readme",
+  "bugs": {
+    "url": "https://github.com/sikkuumi/Defuse/issues"
+  },
+  "type": "module",
+  "bin": {
+    "defuse": "dist/src/cli.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc",
+    "scan": "npm run build --silent && node dist/src/cli.js scan",
+    "test": "npm run build --silent && node dist/tests/run-tests.js",
+    "ast": "npm run build --silent && node dist/src/cli.js ast",
+    "clean": "rm -rf dist",
+    "doctor": "npm run build --silent && node dist/src/cli.js doctor",
+    "rules": "npm run build --silent && node dist/src/cli.js rules",
+    "ui": "npm run build --silent && node scripts/build-ui.mjs && node scripts/serve-ui.mjs",
+    "build:ui": "npm run build --silent && node scripts/build-ui.mjs",
+    "metamorphic": "npm run build --silent && node dist/tests/metamorphic.js",
+    "benchmark": "npm run build --silent && node scripts/label-split.mjs",
+    "dvwa": "npm run build --silent && node scripts/dvwa.mjs",
+    "sync:readme": "npm run build --silent && node scripts/sync-readme.mjs",
+    "prepare": "npm run build",
+    "install-check": "node scripts/install-check.mjs",
+    "git-install-check": "npm run build --silent && node scripts/git-install-check.mjs",
+    "memory": "npm run build --silent && node scripts/memory.mjs",
+    "identity": "npm run build --silent && node scripts/identity.mjs",
+    "label-split": "npm run build --silent && node scripts/label-split.mjs",
+    "build:site": "npm run build --silent && node scripts/build-site.mjs",
+    "review-reasons": "node scripts/review-reasons.mjs",
+    "scoreboard": "npm run build --silent && node scripts/scoreboard.mjs"
+  },
+  "dependencies": {
+    "tree-sitter-wasms": "0.1.13",
+    "web-tree-sitter": "0.25.10"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "@types/sarif": "^2.1.7",
+    "typescript": "^5.7.2"
+  },
+  "keywords": [
+    "sast",
+    "static-analysis",
+    "security",
+    "taint-analysis",
+    "sarif",
+    "tree-sitter",
+    "vulnerability-scanner"
+  ],
+  "files": [
+    "dist/src",
+    "src",
+    "tsconfig.json",
+    "docs/examples",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}